Internet-Security raven logo internet-security.com

TCP 5800

ProtocolTCP
Port5800
LabelsVNC Remote Frame Buffer RFB protocol over HTTP

Synopsis

  • TCP port 5800 is commonly used by VNC servers to serve a web-based (Java) viewer over HTTP, separate from the VNC RFB protocol on port 5900.
  • RealVNC Server provides an embedded web server on 5800 (5800 + display number) to deliver its Java VNC Viewer applet in a browser.
  • TightVNC Server uses 5800 for its HTTP/Java viewer (e.g., display :0 on 5800, :1 on 5801), as does UltraVNC.
  • Xvnc/TigerVNC implementations have historically supported an HTTP Java viewer on port 5800 when configured.
  • Because exposed VNC web interfaces are common, attackers frequently scan and abuse ports 5800/5900 for weak credentials or outdated Java viewer vulnerabilities.

Observed activity

Last 30 days Detailed chart

More information